Skip to content
OpenAdvisories

Weakness (CWE)

CWE-918: Server-Side Request Forgery

Base Incomplete

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

How to prevent it (3 mitigations)

  1. Implementation, Operation

    If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

  2. Implementation, Operation

    If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

  3. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

    When constructing outgoing requests from input strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.

Source: MITRE CWE-918

All Critical High Medium Low Exploited only Public exploit

1,873 results · Clear filters · Feed

  • Medium 6.9
    CVE-2025-34282 Public exploit

    ThingsBoard < v4.2.1 SVG Image SSRF

    ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way th…

    ThingsBoard ThingsBoard
  • Medium 4.4
    CVE-2025-10056

    Task Scheduler <= 1.6.3 - Authenticated (Admin+) Blind Server-Side Request Forgery

    The Task Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.3 via the “Check Website” task. This makes it possible for authenticated attackers, with Administrator-level access and above, to ma…

    miunosoft Task Scheduler Web / CMS
  • Medium 6.5
    CVE-2025-60540

    karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF).

  • Medium 6.8
    CVE-2025-11674

    PiExtract｜SOOP-CLM - Server-Side Request Forgery

    SOOP-CLM developed by PiExtract has a Server-Side Request Forgery vulnerability, allowing privileged remote attackers to read server files or probe internal network information.

    PiExtract SOOP-CLM
  • Medium 5.6
    CVE-2025-11648

    Tomofun Furbo 360/Furbo Mini GATT Interface URL TF_FQDN.json server-side request forgery

    A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from …

    Tomofun Furbo 360 Furbo Mini
  • Medium 5.6
    CVE-2025-11636

    Tomofun Furbo 360 Account server-side request forgery

    A security vulnerability has been detected in Tomofun Furbo 360 up to FB0035_FW_036. This issue affects some unknown processing of the component Account Handler. Such manipulation leads to server-side request forgery. The attack can be executed remotely. This…

    Tomofun Furbo 360
  • Medium 6.8
    CVE-2025-9975

    WP Scraper <= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgery

    The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wp_scraper_extract_content function. This makes it possible for authenticated attackers, with Administrator-level access and a…

    rico-macchi WP Scraper Web / CMS
  • Medium 5.1
    CVE-2025-61768

    Kuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Upload

    KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF (Server-Side Request Forgery) vulnerability exists in the Media module of the Kuno CMS administrative panel. A logged-in administrator can upload a specially craf…

    xuemian168 kuno
  • Medium 4.7
    CVE-2025-11286

    samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery

    A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component MCPRouter Service. This manipulation of the argument baseUrl causes server-side request forgery. Th…

    samanhappy MCPHub
  • Medium 6.9
    CVE-2025-10695

    OpenSupports 4.11.0 — SSRF via test imap and smtp endpoints

    Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service in…

    OpenSupports OpenSupports
  • Medium 4.7
    CVE-2025-55971 Public exploit

    TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to…

  • Medium 6.5
    CVE-2025-57305

    VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.

  • Medium 4.0
    CVE-2025-10735

    Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery

    The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmit_Form_Data(). This makes it possible for unauthenticated attackers …

    bPlugins Block for Mailchimp – Add Email Subscription Forms and Collect Leads Web / CMS
  • Medium 5.3
    CVE-2025-56520 Scanner template

    Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote…

  • Medium 6.9
    CVE-2025-34229

    Vasion Print (formerly PrinterLogic) Blind SSRF via HP installApp.php

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_rele…

    Vasion Print Virtual Appliance Host Print Application
  • Medium 6.9
    CVE-2025-34230

    Vasion Print (formerly PrinterLogic) Blind SSRF via HP log_off_single_sign_on.php

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_rele…

    Vasion Print Virtual Appliance Host Print Application
  • Medium 6.9
    CVE-2025-34232

    Vasion Print (formerly PrinterLogic) Blind SSRF via Lexmark dellCheck.php

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_rele…

    Vasion Print Virtual Appliance Host Print Application
  • Medium 5.4
    CVE-2025-60181

    WordPress Silencesoft RSS Reader Plugin <= 0.6 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Server Side Request Forgery.This issue affects Silencesoft RSS Reader: from n/a through <= 0.6.

    silence Silencesoft RSS Reader
  • Medium 5.4
    CVE-2025-60161

    WordPress ZoloBlocks Plugin <= 2.3.11 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in bdthemes ZoloBlocks zoloblocks allows Server Side Request Forgery.This issue affects ZoloBlocks: from n/a through <= 2.3.11.

    bdthemes ZoloBlocks
  • Medium 5.4
    CVE-2025-10137

    Snow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery

    The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originat…

    inc2734 Snow Monkey Web / CMS
  • Medium 4.3
    CVE-2025-42907

    Server-Side Request Forgery in SAP BI Platform

    SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and …

    SAP SAP BI Platform
  • Medium 6.9
    CVE-2025-9960

    is-localhost-ip 2.0.0 - SSRF via Restrictions bypass

    A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF). This issue affects is-localhost-ip: 2.0.0.

    is-localhost-ip is-localhost-ip
  • Medium 6.4
    CVE-2025-58962

    WordPress Publitio Plugin <= 2.2.1 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in publitio Publitio publitio allows Server Side Request Forgery.This issue affects Publitio: from n/a through <= 2.2.1.

    publitio Publitio
  • Medium 4.4
    CVE-2025-53457

    WordPress SEO Backlink Monitor plugin <= 1.8.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in activewebsight SEO Backlink Monitor seo-backlink-monitor allows Server Side Request Forgery.This issue affects SEO Backlink Monitor: from n/a through <= 1.8.0.

    Active Websight SEO Backlink Monitor
  • Medium 4.4
    CVE-2025-53461

    WordPress Beaf Plugin <= 1.6.2 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Binsaifullah Beaf image-compare-block allows Server Side Request Forgery.This issue affects Beaf: from n/a through <= 1.6.2.

    binsaifullah Beaf
  • Medium 4.4
    CVE-2025-57943

    WordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Skimlinks Skimlinks Affiliate Marketing Tool skimlinks allows Server Side Request Forgery.This issue affects Skimlinks Affiliate Marketing Tool: from n/a through <= 1.3.1.

    Skimlinks Skimlinks Affiliate Marketing Tool
  • Medium 4.4
    CVE-2025-57984

    WordPress MakeStories (for Google Web Stories) Plugin <= 3.0.4 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Pratik Ghela MakeStories (for Google Web Stories) makestories-helper allows Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through <= 3.0.4.

    Pratik Ghela MakeStories (for Google Web Stories)
  • Medium 5.4
    CVE-2025-58005

    WordPress DriCub Theme <= 2.9 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft DriCub dricub-driving-school allows Server Side Request Forgery.This issue affects DriCub: from n/a through <= 2.9.

    SmartDataSoft DriCub
  • Medium 6.4
    CVE-2025-58011

    WordPress Content Mask plugin <= 1.8.5.2 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Alex Content Mask content-mask allows Server Side Request Forgery.This issue affects Content Mask: from n/a through <= 1.8.5.2.

    Alex Content Mask
  • Medium 5.4
    CVE-2025-36037

    IBM webMethods Integration server-side request forgery

    IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

    IBM webMethods Integration
  • Medium 6.3
    CVE-2025-10787

    MuYuCMS Add Fiend Link index.html server-side request forgery

    A vulnerability was found in MuYuCMS up to 2.7. Impacted is an unknown function of the file /index/index.html of the component Add Fiend Link Handler. Performing manipulation of the argument Link URL results in server-side request forgery. The attack may be i…

  • Medium 4.7
    CVE-2025-10765

    SeriaWei ZKEACMS SEOSuggestions ZKEACMS.SEOSuggestions.dll server-side request forgery

    A security flaw has been discovered in SeriaWei ZKEACMS up to 4.3. This vulnerability affects the function CheckPage/Suggestions in the library cms-v4.3\wwwroot\Plugins\ZKEACMS.SEOSuggestions\ZKEACMS.SEOSuggestions.dll of the component SEOSuggestions. Perform…

    SeriaWei ZKEACMS
  • Medium 6.3
    CVE-2025-10764

    SeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgery

    A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs of the component Event Action System. Such manipulation of the argument Data leads to server-…

    SeriaWei ZKEACMS
  • Medium 6.3
    CVE-2025-10760

    Harness lookup_repo.go LookupRepo server-side request forgery

    A flaw has been found in Harness 3.3.0. This impacts the function LookupRepo of the file app/api/controller/gitspace/lookup_repo.go. Executing manipulation of the argument url can lead to server-side request forgery. The attack may be launched remotely. The e…

  • Medium 5.5
    CVE-2025-59346

    Dragonfly server-side request forgery vulnerability

    Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery (SSRF) vulnerability that enables users to force DragonFly2’s components to make requests to internal services…

    dragonflyoss dragonfly d7y.io/dragonfly/v2 github.com/dragonflyoss/dragonfly Go
  • Medium 6.1
    CVE-2025-9862

    Ghost 6.0.6 - SSRF via oEmbed Bookmark

    Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

    Ghost Foundation Ghost ghost npm
  • Medium 6.5
    CVE-2025-57055 Public exploit

    WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An…

  • Medium 6.9
    CVE-2025-59155

    hackmd-mcp server-side request forgery in HTTP transport mode

    hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. From 1.4.0 to before 1.5.0, hackmd-mcp contains a server-side request forgery (SSRF) vulnerability when the server is run in HTTP transport mode. A…

    yuna0x0 hackmd-mcp hackmd-mcp npm
  • Medium 6.3
    CVE-2025-10471

    ZKEACMS MediaController.cs Proxy server-side request forgery

    A vulnerability was detected in ZKEACMS 4.3. Impacted is the function Proxy of the file src/ZKEACMS/Controllers/MediaController.cs. Performing manipulation of the argument url results in server-side request forgery. It is possible to initiate the attack remot…

  • Medium 5.3
    CVE-2025-10453

    PilotGaea Technologies｜O'View MapServer - Server-Side Request Forgery

    O'View MapServer developed by PilotGaea Technologies has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal network.

    PilotGaea Technologies O'View MapServer